topic Re: Appending Incident field from a script in Cortex XSOAR Discussions

Appending Incident field from a script

oDarweesh2 — Wed, 28 Dec 2022 12:17:52 GMT

Dears,

I am blocking urls on a security control then save the value of URL in incident field name (blocked urls) using setIncident command,

But every time I block new url the incident field is not appending the new url to the old url. It replace the old value with the new value.

Kindly need your suggestion for how to append the value in incident field.

Note: The incident field is array type.

Re: Appending Incident field from a script

jqamruddin — Tue, 03 Jan 2023 19:26:43 GMT

Hi @oDarweesh2! I see that you mention that the incident field is a type array, could you confirm if it is a multi-select array and to dynamically add?

So, setIncident has an argument called appendMultiSelect and when you set that to true (appendMultiSelect=true), with this it will allow you to be able to append more values to the incident field name. The caveat is that the incident field needs to be the Field Type of Multi select/Array.

In the war room, it would look like !setIncident appendMultiSelect=True field_value=someurlblocked, where field_value is a multi-select array

Hope that helps!